Is CVE-2026-88963 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88963 being exploited in the wild.

How severe is CVE-2026-88963?

Medium severity, with a CVSS score of 6.1, published 16 October 2026.

Which products and versions are affected?

Tutor LMS up to and including 4.0.8.

Is there a fix for CVE-2026-88963?

Yes: fixed in 4.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88963 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-88963?

Check whether you run Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88963: Tutor LMS DOM-based XSS in redirect_url parameter

CVE-2026-88963 · Severity: medium · CVSS 6.1 · Published 2026-10-16

Tutor LMS is a WordPress plugin that provides an online course and learning management platform. The plugin fails to properly validate user input in the redirect_url parameter, allowing unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they visit a crafted page link. This could lead to credential theft, session hijacking, or malware distribution to course participants and instructors.

Technologies: Tutor LMS. Vendors: Tutor.

Quick answers

Is CVE-2026-88963 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88963 being exploited in the wild.
How severe is CVE-2026-88963?: Medium severity, with a CVSS score of 6.1, published 16 October 2026.
Which products and versions are affected?: Tutor LMS up to and including 4.0.8.
Is there a fix for CVE-2026-88963?: Yes: fixed in 4.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88963 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-88963?: Check whether you run Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0.9

Technical details

The vulnerability is a DOM-based Cross-Site Scripting (XSS) flaw in the Topbar component's back button handler that does not properly validate the redirect_url parameter. An unauthenticated attacker can craft a malicious URL with JavaScript payload in the redirect_url parameter, and when a victim clicks the link or visits the page, the script executes in their browser context. The flaw affects versions through 4.0.8, and a fix appears to be available in version 4.0.9.

Affected products

Tutor Tutor LMS up to and including 4.0.8

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.